Commit Graph
240 Commits
Author SHA1 Message Date
Federico CoppedeandGitHub 23c31ab2cb docs: remove user-schema page reference from the docs (#11394)
This PR removes the user-schema page from the sidebar menu
2026-01-20 15:10:27 -03:00
32877972e8 docs: created egress IPs page for Zitadel Cloud (#11376)
Added the list of egress IPs per region for Zitadel Cloud outgoing
requests from Actions/IDP connections/SMTP/SMS/etc.

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
2026-01-20 12:10:57 -03:00
054b03f20c chore: naming trusted domain (#11384)
# Which Problems Are Solved

As part of the consistent naming effort, this PR focuses on "Trusted
Domains".

# How the Problems Are Solved

- All terms referring to a domain that is used in API responses were
changed to "Trusted Domain" or "trusted domain".

# Additional Changes

None

# Additional Context

- closes #11297

---------

Co-authored-by: Copilot <[email protected]>
2026-01-20 15:08:47 +05:30
Livio SpringandGitHub 8c0d6c6817 chore: naming custom domain (#11383)
# Which Problems Are Solved

As part of the consistent naming effort, this PR focuses on "Custom
Domains".

# How the Problems Are Solved

- All terms referring to a domain identifying an instance were changed
to "Custom Domain" or "custom domain".
- All placeholders were changed to `${CUSTOM_DOMAIN}` or
`$CUSTOM_DOMAIN` (if escaping was not possible)
- Some other placeholders were change to the same style.
- One occurrence of custom domain was changed to organization domain to
prevent misunderstandings.

# Additional Changes

None

# Additional Context

- closes #11296 
- customer portal is fixed on
https://github.com/zitadel/website/pull/1570
- angular example is updated on
https://github.com/zitadel/zitadel-angular/pull/29
2026-01-20 10:26:57 +05:30
Federico CoppedeandGitHub dc01a0abff docs: fixed broken references docs homepage (#11357)
Fixed broken references in the Zitadel docs homepage
2026-01-14 17:26:01 +05:30
Mridang AgarwallaandGitHub 4784c5ce73 docs: added the updated docs for the new examples (#11198) 2026-01-14 09:25:58 +00:00
Federico CoppedeandGitHub 7276c40261 docs: fixed broken references (#11341)
This PR resolves some broken references found in the documentation.
2026-01-12 21:09:40 +00:00
96f9bbc044 docs: structure update (#11275)
### **Restructure Docs Navigation & Consolidate Core Concepts**

**Summary**
This PR refactors the documentation navigation to follow a clearer
**User Journey** and consolidates fragmented pages to reduce redundancy.

**Key Changes**

* **Sidebar:**
* Replaced the legacy resource-based structure with user-journey-focused
categories.

**Proposed Structure:**

```
Get Started
├─ Overview
│   └─ Guides Overview (Brief intro to docs, persona-aligned: "Get auth working in minutes for your B2B app.")
├─ Quickstart Guide
│   └─ Quickstart (Step-by-step: Sign up, spin up instance, connect app, log in – mirrors brand's 4-step guide.)
├─ Authenticate Users
│   ├─ Login with ZITADEL (OIDC)
│   ├─ Get ID / Access Token
│   └─ Logout
├─ Examples & SDKs
│   ├─ SPA / Frontend
│   ├─ Web Applications
│   ├─ APIs / Backend Services
│   ├─ Hybrid / Full-Stack
│   └─ Sample Applications (Include community-contributed examples for openness.)
├─ Key Concepts
│   ├─ Instances, Orgs, Projects, Apps
│   ├─ Policies (Intro)
│   └─ Users & Roles
└─ Use Cases
    ├─ B2B Integration (Tailored to multi-tenant enterprise needs.)
    ├─ B2C Login
    ├─ Multi-Tenant / SaaS
    ├─ Branded Login & White-Label
    └─ Machine-to-Machine (M2M)

Configure Identity & Policies
├─ Identity Providers
│   ├─ External IDPs (e.g., Google, Azure)
│   └─ Custom Providers
├─ Policies
│   ├─ Password Policies
│   ├─ Lockout Policies
│   └─ Privacy Policies
├─ Roles & Permissions
│   ├─ RBAC Setup
│   └─ Custom Roles
└─ Compliance & Security
    ├─ Audits & Logs
    └─ Certifications (Highlight trust through openness.)

Integrate & Authenticate
├─ OIDC & OAuth Flows
├─ API Access
│   ├─ gRPC APIs
│   └─ REST APIs
├─ SDKs
│   ├─ Go
│   ├─ JavaScript/TypeScript
│   ├─ Python
│   └─ Others (Link to community SDKs.)
└─ External Integrations
    ├─ SAML
    ├─ LDAP
    └─ Webhooks

Test & Debug
├─ Testing Tools
│   ├─ Console Testing
│   └─ API Playground
├─ Common Issues
│   ├─ Token Errors
│   └─ Integration Failures
└─ Debugging Guides
    ├─ Logs & Monitoring
    └─ Error Codes Reference

Deploy & Operate
├─ Deployment Options
│   ├─ Cloud (ZITADEL Cloud)
│   ├─ Self-Hosted (Linux, MacOS)
│   ├─ Docker Compose
│   └─ Kubernetes
├─ Configuration
│   ├─ Environment Variables
│   └─ Advanced Settings
├─ Scaling & Performance
│   ├─ High Availability
│   └─ Backup & Restore
└─ Monitoring & Maintenance
    ├─ Metrics
    └─ Upgrades

Architecture & Concepts
├─ System Architecture
│   ├─ Core Components
│   └─ Data Flow Diagrams (Expressive visuals per brand.)
├─ Principles
│   ├─ Multi-Tenancy
│   └─ Open Standards (OIDC, SAML)
└─ Advanced Topics
    ├─ Customization
    └─ Extensibility (Open-source contributions.)

Product, Releases & Support
├─ Product Features
│   ├─ Roadmap (Public, for transparency.)
│   └─ Pricing & Tiers
├─ Releases
│   ├─ Changelog
│   └─ Upgrade Guides
└─ Support Resources
    ├─ Community (Discord, GitHub – for community-led growth.)
    ├─ FAQ
    ├─ Contact Support
    └─ Contribute (Encourage feedback/shaping the product.)
```

**Content Consolidation:**
* Merged separate "Concept" and "Console Guide" files into single,
comprehensive **Overview** pages for core resources:
* `Organizations`, `Projects`, `Applications`, `Users`, `Console`, and
`Actions`.

```
concepts/structure/organizations + guides/manage/console/organizations -> guides/manage/console/organizations-overview

concepts/structure/projects + guides/manage/console/projects -> guides/manage/console/projects-overview

concepts/structure/applications + guides/manage/console/applications -> guides/manage/console/applications-overview

concepts/structure/users + guides/manage/console/users -> guides/manage/console/users-overview

guides/manage/console/actions + apis/actions/introduction -> guides/manage/console/actions-overview

concepts/features/console + guides/manage/console/overview -> guides/manage/console/console-overview
```


**Redirects (`vercel.json`):**
* Added permanent redirects for all the 6 legacy files mentioned above



**No files were deleted**

---------

Co-authored-by: Florian Forster <[email protected]>
2026-01-09 15:07:02 -03:00
5f34d1af8f chore: forward port organization v2 API changes (#11207)
# Which Problems Are Solved

Recent changes to the v2beta and v2 API of the organization service were
directly merged to the `next` branch and release on v4.x, since the
ongoing move to the relation table, blocked it from being merged into
main.

# How the Problems Are Solved

This PR ports the following changes into main:
- fix(api): correct permission check in organization v2beta service:
https://github.com/zitadel/zitadel/commit/8dcfff97ed52a8b9fc77ecb1f972744f42cff3ed
- fix(actions v1): return org metadata again
(https://github.com/zitadel/zitadel/pull/11040)
- feat(api): move organization api
(https://github.com/zitadel/zitadel/pull/11045)

# Additional Changes

None

# Additional Context

relates to #10772

---------

Co-authored-by: Gayathri Vijayan <[email protected]>
2026-01-05 14:14:01 +00:00
Matías RacedoandGitHub ce85d8e8ed docs(guide): Using Prometheus to scrape Zitadel metrics (#11255)
Resolves #6062
2026-01-02 12:58:18 -03:00
Matías RacedoandGitHub 9a29eebd72 docs(guide): OneLogin SAML IdP integration guide (#11257)
Resolves #7280
2026-01-02 09:25:01 -03:00
Matías RacedoandGitHub ee6d66d429 docs(Guides): Add PingFederate SAML IdP guide (#11244)
This solves issue #10545
2025-12-30 17:05:52 -03:00
740669a4bd docs: remove out-dated / incorrect beta labels (#11211)
# Which Problems Are Solved

Some features moved from Beta to GA in V4, are still labeled as beta in
the docs and APIs refer to the now deprecated beta endpoints.

# How the Problems Are Solved

- remove the beta labels from webkeys, login v2, actions v2
- change example calls and API reference to v2 (instead of v2beta)

# Additional Changes

fixed typo in the web keys title (Oauth2 -> OAuth2)

# Additional Context

- Organization service v2(beta) is solved in
https://github.com/zitadel/zitadel/pull/11207
- relates to #10772

---------

Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-12-29 16:46:02 +00:00
Federico CoppedeandGitHub 8a0580b358 docs: fix deprecated label for actions v2 (#11242)
Removed deprecated label for Action V2 endpoints and removed Beta label
also. Fixed actions V2 domain endpoint (v2 instead of v2beta)
2025-12-29 17:26:49 +01:00
791d0587aa feat(action v2): add JWT and JWE payload type options (#11196)
# Which Problems Are Solved

The payload in actions V2 is currently sent as JSON to the target
endpoint. It might get exposed to intermediary infrastructure or logging
systems.
For these scenarios there needs to be an application-layer encryption,
where the provider of the endpoint can define an key to be used for the
encryption.

# How the Problems Are Solved

- Added an additional option to the target to specify the payload type:
`JSON` (current and default), `JWT`, `JWE` (api and console)
- added endpoints to upload and manage public keys (to be used for
encryption) for a target
- updated all action v2 executions (interceptors, oidc, saml, ...) to
provide the `GetActiveSigningWebKey` from queries
- implemented jwt and jwe in the exections incl. refactoring of code and
tests
- changes to the authn_keys table:
  - added a `fingerprint` column
  - dropped not null constraint on expiration
- moved the `GetSignerOnce` into its own package to prevent circular
dependencies

# Additional Changes

None

# Additional Context

closes #11061

---------

Co-authored-by: Marco A. <[email protected]>
Co-authored-by: conblem <[email protected]>
Co-authored-by: Silvan <[email protected]>
2025-12-29 13:35:53 +00:00
Federico CoppedeandGitHub 03916cd0f2 docs: create guide for generic OIDC IDP (#11233)
Fixes #7191
2025-12-26 15:40:21 -03:00
Livio SpringandGitHub c2a0b9d187 feat(api): move instance service to v2 (#10919)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves instance v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing
- `Domain` has been renamed to `CustomDomain` to align with naming
conventions
- `..Query` has been renamed to `..Filter` to align with other services
- The `instance_id` parameter can now passed on all endpoints and is
properly used, but requires `system` permissions. It can be omitted to
use the own instance (identified by context as any other service).
  - The following endpoints are affected:
    - GetInstance
    - UpdateInstance
    - ListCustomDomains
    - AddTrustedDomain
    - RemoveTrustedDomain
    - ListTrustedDomains
- InstanceService has been added the InstanceInterceptor's
`explicitInstanceIdServices` to allow passing the id
- If the instance is not found by id, the error is not directly returned
to prevent enumeration.
- Permissions are checked in the API instead of the interceptor for
these calls.
- Setting the same instance name in the update no longer returns an
error, but the previous change date.
 
# Additional Changes

none

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x
2025-10-28 14:01:14 +01:00
Livio SpringandGitHub 32500e3b0c feat(api): move project service v2beta to GA (and deprecate v2beta) (#10844)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves project v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with `(google.api.field_behavior)
= REQUIRED` and validation rules have been added where missing.
- Name ID of the project always `project_id`
- `UpdateProjectRequest` has been updated to align with the creation and
retrieval of a project:
  - `project_role_check` has been renamed to `authorization_required`
  - `has_project_check` has been renamed to `project_access_required`
- `ListProjectRequest` has been changed:
- `project_grant_resource_owner_filter`,
`project_grant_resource_owner_filter` and
`project_organization_id_filter` have been removed and merged into a
single `organization_id_filter` where a `type` can optionally be
specified to select `owned`, `granted` or both project types within a
specified organization.
- `ListProjectGrantReques` has been changed:
- `project_resource_owner_filter` has been renamed to
`project_organization_id_filter`
- `grant_resource_owner_filter` has been renamed to
`granted_organization_id_filter`

# Additional Changes

Replaced deprecated `intergration.WithAuthorization` with
`integration.WithAuthorizationToken` in integration tests.

# Additional Context

- part of #10772 
- requires backport to v4.x
2025-10-28 12:28:45 +00:00
Livio SpringandGitHub c9ac1ce344 feat(api): move authorization service to v2 (#10914)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves the authorization v2beta service and its endpoints to a
corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- The `organization_id` to create an authorization is now required to be
always passed. There's no implicit fallback to the project's
organization anymore.
- The `user_id` filter has been removed in favor of the recently added
`in_user_ids` filter.
- The returned `Authorization` object has been reworked to return
`project`, `organization` and `roles` as objects like the granted `user`
already was.
- Additionally the `roles` now not only contain the granted `role_keys`,
but also the `display_name` and `group`. To implement this the query has
been updated internally. Existing APIs are unchanged and still return
just the keys.

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- closes #10746 
- requires backport to v4.x
2025-10-28 12:11:12 +00:00
Livio SpringandGitHub 0281670030 feat(api): move application service v2beta to GA (and deprecate v2beta) (#10846)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves app v2beta service and its endpoints to a corresponding
to application v2 version. The v2beta service and endpoints are
deprecated.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- Name ID of the application always `application_id`, previously was
also `id` and `app_id`.
- Get rid of all `app` abbreviations and name it `application` including
the service name, `AppState` -> `ApplicationState` and `AppSorting` ->
`ApplicationSorting`
- Updated `CreateApplicationRequest`:
- renamed `creation_request_type` to `application_type` and all its
options to `XY_configuration` instead of `XY_request`
- `RegenerateClientSecret`
  - renamed method to `GenerateClientSecret`
  - removed `app_type` from request
- `ListApplicationRequest`:
  - removed required `project_id` and provided it as a filter
- Type `ApplicationNameQuery` has been renamed to
`ApplicationNameFilter` as its usage in the request
- Renamed all fields and types from `config` to `configuration`
- Updated `DeleteApplicationKeyRequest`
  - removed `organization_id`
- Updated `GetApplicationKeyRequest`:
  - removed `project_id`, `application_id` and `organization_id``
- Updated `ListApplicationKeysRequest`:
  - removed oneOf `resource_id` and moved the options into filters
- Name ID of the application key always `key_id`.
- removed unnecessary package prefixed (`zitadel.application.v2`)
- formatted using `buf`

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x
2025-10-17 10:12:20 +02:00
0f2a349ec1 feat(api): move internal permission service to GA (and deprecate v2beta) (#10898)
# Which Problems Are Solved

As part of our efforts to simplify the structure and versions of our
APIs, were moving all existing v2beta endpoints to v2 and deprecate
them. They will be removed in Zitadel V5.

# How the Problems Are Solved

- This PR moves the internal permission v2beta service and its endpoints
to a corresponding v2 version. The v2beta service and endpoints are
deprecated.
- The docs are moved to the new GA service and its endpoints. The v2beta
is not displayed anymore.
- The comments and have been improved and, where not already done, moved
from swagger annotations to proto.
- All required fields have been marked with (google.api.field_behavior)
= REQUIRED and validation rules have been added where missing.
- Listing administrators of a project grant can now be done with the
`ProjectGrant` (`project_id` and `organization_id`) instead of a
`project_id`, which corresponds to creation of the administrator ship of
such grant.
- formatted using `buf`

# Additional Changes

None

# Additional Context

- part of https://github.com/zitadel/zitadel/issues/10772
- requires backport to v4.x

---------

Co-authored-by: Gayathri Vijayan <[email protected]>
2025-10-17 07:35:35 +02:00
7ee74c3354 docs: prepare for archiving the TypeScript repo (#10751)
# Which Problems Are Solved

The Login mirror repo https://github.com/zitadel/typescript is outdated.
With the DevX improvements done in #10571, forking the zitadel repo and
developing and deploying the Login became easy. This means, the
maintenance and mental overhead of syncing to the mirror repo is not
justified anymore.
This PR removes all references and mentions of the mirror repo, so we
can archive it.

# How the Problems Are Solved

- Fixed the *Deploy with Vercel* button to source the Login app from the
https://github.com/zitadel/zitadel repo.
- Renamed *Typescript Login UI* to *Login app*. This reflects the Nx
terminology in the Zitadel repo, as the Login is an Nx project in the
`apps` directory.
- Changed the typescript-repo route and configured a Vercel redirect
from `/docs/guides/integrate/login-ui/typescript-repo` to
`/docs/guides/integrate/login-ui/login-app`

# Additional Changes

- Removes the *Beta* status from the Login application

# Additional Context

- Depends on #10571 because it contains links to the updated
CONTRIBUTING.md as well as the updated docs build command in Vercel.json

---------

Co-authored-by: Copilot <[email protected]>
2025-10-09 11:46:29 +00:00
Federico CoppedeandGitHub de0667bb24 docs: added zitadel-vanilla-js link and reference (#10807)
Added a link to the new vanilla-js SPA example on the sidebar, and the
card + image on the resources here:
- https://zitadel.com/docs/sdk-examples/introduction 

New sample app:
- https://github.com/zitadel/zitadel-vanilla-js
2025-09-26 16:53:33 -03:00
Federico CoppedeandGitHub 44902e11b7 docs: update release cycle and support states URL to point to KBAs (#10602)
The page located here was split into 2 different KBAs:
- https://zitadel.com/docs/support/software-release-cycles-support

**Software release cycles:** 
- https://help.zitadel.com/zitadel-software-release-cycle

**Support states KBA:** 
- https://help.zitadel.com/zitadel-support-states

And the corresponding URLs were updated in the docs site
2025-09-22 11:29:34 +00:00
d2d9a2e651 docs: add guide to setup webhook.site for actions v2 (#10665)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

Added guide to setup webhook.site

# How the Problems Are Solved

Users can now learn how to setup listener over the internet

# Additional Changes
none

# Additional Context
none

---------

Signed-off-by: Rajat Singh <[email protected]>
Co-authored-by: Rajat Singh <[email protected]>
2025-09-12 16:41:37 -03:00
Matías RacedoandGitHub e3dff2482e docs: Merged the two existing Auth0 migration guides (#10619)
Merged the two Auth0 migration guides into a single one, keeping the
path from the oldest one.

Changes:
deleted:    docs/docs/guides/migrate/sources/auth0-guide.md
modified:   docs/docs/guides/migrate/sources/auth0.md
modified:   docs/sidebars.js
2025-09-02 05:41:06 +00:00
2abcec00e8 docs: SCIM provisioning from Okta to ZITADEL (#10437)
Adds a step-by-step guide for configuring SCIM provisioning from Okta
into ZITADEL using a service user with the Org User Manager role,
including authentication options and SCIM endpoint details.

---------

Co-authored-by: Stefan Benz <[email protected]>
2025-08-20 11:58:40 +00:00
5e1f0d7e3e docs: remove old keycloak guide (#10483)
̶r̶e̶m̶o̶v̶e̶ ̶o̶l̶d̶ ̶k̶e̶y̶c̶l̶o̶a̶k̶ ̶g̶u̶i̶d̶e̶
̶h̶t̶t̶p̶s̶:̶/̶/̶z̶i̶t̶a̶d̶e̶l̶.̶c̶o̶m̶/̶d̶o̶c̶s̶/̶g̶u̶i̶d̶e̶s̶/̶m̶i̶g̶r̶a̶t̶e̶/̶s̶o̶u̶r̶c̶e̶s̶/̶k̶e̶y̶c̶l̶o̶a̶k̶
̶n̶e̶w̶ ̶o̶n̶e̶ ̶e̶x̶i̶s̶t̶s̶
̶h̶t̶t̶p̶s̶:̶/̶/̶z̶i̶t̶a̶d̶e̶l̶.̶c̶o̶m̶/̶d̶o̶c̶s̶/̶g̶u̶i̶d̶e̶s̶/̶m̶i̶g̶r̶a̶t̶e̶/̶s̶o̶u̶r̶c̶e̶s̶/̶k̶e̶y̶c̶l̶o̶a̶k̶-̶g̶u̶i̶d̶e̶

---------

Signed-off-by: Rajat Singh <[email protected]>
Co-authored-by: Rajat Singh <[email protected]>
2025-08-20 10:32:35 +00:00
SilvanandGitHub 9a799a7c7b docs: benchmarks for v4 (#10360)
Introduce benchmark documentation and results for various endpoints in
the Zitadel v4 release, including performance metrics and test
configurations.
2025-08-19 14:21:12 +00:00
c83a85dee9 docs(legal): remove billing page to redirect to the HubSpot KBA URL (#10488)
Removed the billing md document and updated the links to the HubSpot KBA
-> https://help.zitadel.com/pricing-and-billing-of-zitadel-services

Co-authored-by: Maximilian <[email protected]>
2025-08-18 11:21:00 -03:00
57a0abdcc7 docs: correct api v2 docs for zitadel v4 (#10249)
# Which Problems Are Solved

As documentation is published from the main branch and the releases get
created from another branch, they are not always correctly equal.

# How the Problems Are Solved

Add previously removed docs again to the documentation.
Add deprecation notes on all replaced endpoints related to
administrators, authentications and projects.

## Deprecated endpoints

- Management service
  - to Organization service v2
    - GetOrgByDomainGlobal
  - to User service v2
    - AddMachineUser
    - UpdateMachine
    - GenerateMachineSecret
    - RemoveMachineSecret
    - GetMachineKeyByIDs
    - ListMachineKeys
    - AddMachineKey
    - RemoveMachineKey
    - UpdateUserName
    - SetUserMetadata
    - BulkSetUserMetadata
    - ListUserMetadata
    - GetUserMetadata
    - RemoveUserMetadata
    - BulkRemoveUserMetadata
    - UpdateHumanPhone
    - GetPersonalAccessTokenByIDs
    - ListPersonalAccessTokens
    - AddPersonalAccessToken
    - RemovePersonalAccessToken
  - to Application service v2beta
    - ListAppKeys
  - to Project service v2beta
    - GetProjectByID
    - GetGrantedProjectByID
    - ListProjects
    - ListGrantedProjects
    - ListGrantedProjectRoles
    - AddProject
    - UpdateProject
    - DeactivateProject
    - ReactivateProject
    - RemoveProject
    - ListProjectRoles
    - AddProjectRole
    - BulkAddProjectRoles
    - UpdateProjectRole
    - RemoveProjectRole
    - GetProjectGrantByID
    - ListProjectGrants
    - ListAllProjectGrants
    - AddProjectGrant
    - UpdateProjectGrant
    - DeactivateProjectGrant
    - ReactivateProjectGrant
    - RemoveProjectGrant
  - to Internal Permission service v2beta
    - ListUserMemberships
    - ListOrgMembers
    - AddOrgMember
    - UpdateOrgMember
    - RemoveOrgMember
    - ListProjectMembers
    - AddProjectMember
    - UpdateProjectMember
    - RemoveProjectMember
    - ListProjectGrantMembers
    - AddProjectGrantMember
    - UpdateProjectGrantMember
    - RemoveProjectGrantMember
- Admin service
  - to Instance service v2
    - GetMyInstance
    - ListInstanceDomains
    - ListInstanceTrustedDomains
    - AddInstanceTrustedDomain
    - RemoveInstanceTrustedDomain
  - to Organization service v2
    - GetOrgByID
    - IsOrgUnique
    - GetDefaultOrg
  - to Internal Permission service v2beta
    - ListIAMMembers
    - AddIAMMember
    - UpdateIAMMember
    - RemoveIAMMember

# Additional Changes

None

# Additional Context

Related to #10112

---------

Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Gayathri Vijayan <[email protected]>
Co-authored-by: Marco A. <[email protected]>
2025-08-08 14:51:58 +02:00
4930870504 docs(login v2): update proxy examples (#10358)
# Which Problems Are Solved

- The proxy examples are updated so a self-hosted login container is
deployed.
- The proxies are configured to direct traffic at /ui/v2/login to it.

# How the Problems Are Solved

The base compose file is extended by correctly configured login
containers for all three scenarios
- TLS disabled
- External TLS
- TLS Enabled

The proxy always connects to the login via HTTP.

# Additional Changes

- All proxies have the TLS disabled mode outcommented, because the login
container has state problems, maybe because it needs secure cookies. The
need for this is unclear, so we avoid creating a follow-up issue.
- The httpd external mode is incommented, as gRPC connections work with
this configuration.
- *ZITADEL* is replaced by *Zitadel*

# Additional Context

- Partially Closes #10016

---------

Co-authored-by: Copilot <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
2025-08-07 16:58:18 +00:00
Elio BischofandGitHub 5f7851768b docs(self-hosting): remove Knative example (#10342)
# Which Problems Are Solved

The Knative docs are removed, as they are not relevant enough.

# How the Problems Are Solved

- The docs page is removed
- The sidebar item is removed

# Additional Context

- Partially Closes #10016
2025-08-07 18:27:24 +02:00
Elio BischofandGitHub 7e184727b0 docs: simplify compose example (#10407)
# Which Problems Are Solved

Using the compose configuration with for existing installation doesn't
work.
It is not appreciated in the whole community, that we use Traefik for
the deployment example.

# How the Problems Are Solved

- The config we used before v4 is reused and extended in a compatible
way.
- Traefik is removed, Zitadel is accessible again at localhost:8080 and
the login at localhost:3000. Deploying with Traefik is described already
here http://localhost:3000/docs/self-hosting/manage/reverseproxy/traefik
- A page is added that describes how to create a login client and switch
from login v1 to v2. The page is linked in a hint in the compose
example.

# Additional Changes

- The config also sets up a machine user and documents it inline. This
allows us to avoid using the cumbersome separate docker-compose-sa.yaml

# Additional Context

- Closes #10379 
- Internal discussion
https://zitadel.slack.com/archives/C08TL9AURL7/p1754471184222879
- Discord about upgrading to v2 login:
-
https://discord.com/channels/927474939156643850/927866013545025566/threads/1401950163940933804
-
https://discord.com/channels/927474939156643850/927866013545025566/1401312126030708756
- Discord about not found errors:
-
https://discord.com/channels/927474939156643850/927866013545025566/threads/1401173877941473291
-
https://discord.com/channels/927474939156643850/927866013545025566/1401045717849604227
-
https://discord.com/channels/927474939156643850/927866013545025566/1401173877941473291
-
https://discord.com/channels/927474939156643850/927866013545025566/1401301168998584361
2025-08-06 20:48:54 +00:00
Livio SpringandGitHub 28d70db6ae docs: document service ping configuration and data sent (#10167)
# Which Problems Are Solved

With the introduction of the service ping, we'll send data from all
systems back to a central endpoint for analytics and getting insights
about usage. To make it visible what data is sent and provide the users
an easy way to opt-out, we need a small documentation to tell them what
and how.

# How the Problems Are Solved

Document the service ping including what data is sent and how to opt-out
or configure most important settings.

# Additional Changes

None

# Additional Context

relates to #9869
2025-07-31 10:23:19 +00:00
b06e4e2f9c docs(self-hosting): simplify lb example and replace compose example (#9844)
# Which Problems Are Solved

The load balancing compose example uses a dedicated service
`use-new-login` that gives the set up machine user the login role and
requires the v2 login using an instance feature. This is cumbersome and
unnecessary.

# How the Problems Are Solved

- A login client machine user is set up and the token is passed to the
login by using the environment variable ZITADEL_SERVICE_USER_TOKEN_FILE.
- The unnecessary service is removed

# Additional Changes

- Uses the static `MasterkeyNeedsToHave32Characters` master key.
- The load balancing example replaces the previous Docker Compose
example.
- The login uses `network_mode: service:zitadel` so it can access the
zitadel service in the docker network via localhost.
- Uses the docker provider for Traefik.

# Additional Context

- Complements https://github.com/zitadel/zitadel/pull/9496
- Partially closes https://github.com/zitadel/zitadel/issues/10016
- When we release, we should update the image tags to latest, for
example with [this PR](https://github.com/zitadel/zitadel/pull/10249).

---------

Co-authored-by: Tim Möhlmann <[email protected]>
2025-07-31 12:51:38 +03:00
82e4466928 docs: deprecate organization v2beta endpoints + remove scim preview notice (#10350)
# Which Problems Are Solved

The documentation API regarding organization v2 beta is not up to date.

The documentation regarding SCIM v2 is not up to date.

# How the Problems Are Solved

- Deprecate the existing v2beta endpoints `CreateOrganization` and
`ListOrganizations` in favour of the v2 counterparst
  - Remove the preview warning from SCIM v2 pages

# Additional Context

- Closes #10311 and #10310

---------

Co-authored-by: Marco Ardizzone <[email protected]>
2025-07-30 11:41:25 +00:00
af66c9844a docs(migration): Added step-by-step guide for the Keycloak to Zitadel migration (#10304)
Added a step-by-step guide for Keycloak to Zitadel migration for the
workshop tomorrow

---------

Signed-off-by: RAJAT SINGH <[email protected]>
Signed-off-by: Rajat Singh <[email protected]>
Co-authored-by: RAJAT SINGH <[email protected]>
Co-authored-by: Rajat Singh <[email protected]>
2025-07-23 14:18:41 -03:00
Mridang AgarwallaandGitHub 63b894908c docs: add initial docs for the new client-libraries (#10230)
# Which Problems Are Solved

The recently released client libraries were missing documentation, which
made it difficult for developers to understand and use the new features.

# How the Problems Are Solved

This pull request introduces the necessary documentation for the new
client libraries, covering their installation and basic usage.

# Additional Changes

None.

# Additional Context

This documentation supports the recent client library release.
2025-07-21 12:32:00 +05:30
27cd1d8518 docs(api): add new beta services to api reference (#10018)
# Which Problems Are Solved

The unreleased new resource apis have been removed from the docs:
https://github.com/zitadel/zitadel/pull/10015

# How the Problems Are Solved

Add them to the docs sidenav again, since they're now released.

# Additional Changes

none

# Additional Context

none

---------

Co-authored-by: Fabienne <[email protected]>
Co-authored-by: Marco Ardizzone <[email protected]>
2025-07-04 19:00:24 +02:00
5403be7c4b feat: user profile requests in resource APIs (#10151)
# Which Problems Are Solved

The commands for the resource based v2beta AuthorizationService API are
added.
Authorizations, previously knows as user grants, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The given roles can be used to restrict access within the projects
applications.

The commands for the resource based v2beta InteralPermissionService API
are added.
Administrators, previously knows as memberships, give a user in a
specific organization and project context roles.
The project can be owned or granted.
The give roles give the user permissions to manage different resources
in Zitadel.

API definitions from https://github.com/zitadel/zitadel/issues/9165 are
implemented.

Contains endpoints for user metadata.

# How the Problems Are Solved

### New Methods

- CreateAuthorization
- UpdateAuthorization
- DeleteAuthorization
- ActivateAuthorization
- DeactivateAuthorization
- ListAuthorizations
- CreateAdministrator
- UpdateAdministrator
- DeleteAdministrator
- ListAdministrators
- SetUserMetadata to set metadata on a user
- DeleteUserMetadata to delete metadata on a user
- ListUserMetadata to query for metadata of a user

## Deprecated Methods

### v1.ManagementService
- GetUserGrantByID
- ListUserGrants
- AddUserGrant
- UpdateUserGrant
- DeactivateUserGrant
- ReactivateUserGrant
- RemoveUserGrant
- BulkRemoveUserGrant

### v1.AuthService
- ListMyUserGrants
- ListMyProjectPermissions

# Additional Changes

- Permission checks for metadata functionality on query and command side
- correct existence checks for resources, for example you can only be an
administrator on an existing project
- combined all member tables to singular query for the administrators
- add permission checks for command an query side functionality
- combined functions on command side where necessary for easier
maintainability

# Additional Context

Closes #9165

---------

Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
2025-07-04 18:12:59 +02:00
9ebf2316c6 feat: exchange gRPC server implementation to connectRPC (#10145)
# Which Problems Are Solved

The current maintained gRPC server in combination with a REST (grpc)
gateway is getting harder and harder to maintain. Additionally, there
have been and still are issues with supporting / displaying `oneOf`s
correctly.
We therefore decided to exchange the server implementation to
connectRPC, which apart from supporting connect as protocol, also also
"standard" gRCP clients as well as HTTP/1.1 / rest like clients, e.g.
curl directly call the server without any additional gateway.

# How the Problems Are Solved

- All v2 services are moved to connectRPC implementation. (v1 services
are still served as pure grpc servers)
- All gRPC server interceptors were migrated / copied to a corresponding
connectRPC interceptor.
- API.ListGrpcServices and API. ListGrpcMethods were changed to include
the connect services and endpoints.
- gRPC server reflection was changed to a `StaticReflector` using the
`ListGrpcServices` list.
- The `grpc.Server` interfaces was split into different combinations to
be able to handle the different cases (grpc server and prefixed gateway,
connect server with grpc gateway, connect server only, ...)
- Docs of services serving connectRPC only with no additional gateway
(instance, webkey, project, app, org v2 beta) are changed to expose that
- since the plugin is not yet available on buf, we download it using
`postinstall` hook of the docs

# Additional Changes

- WebKey service is added as v2 service (in addition to the current
v2beta)

# Additional Context

closes #9483

---------

Co-authored-by: Elio Bischof <[email protected]>
2025-07-04 14:06:20 +00:00
Matías RacedoandGitHub 27f88a6390 docs(migration): Added step-by-step guide for the Auth0 to Zitadel migration (#10118)
Added a step-by-step guide for the Auth0 to Zitadel migration in
preparation for the upcoming workshop.
2025-06-25 12:44:11 -03:00
Livio SpringandGitHub e2a61a6002 docs(api): remove unreleased services from api reference (#10015)
# Which Problems Are Solved

As we migrate resources to the new API, whenever a an implementation got
merged, the API reference was added to the docs sidenav. As these new
services and their implementation are not yet released, it can be
confusing for developers as the corresponding endpoints return 404 or
unimplemented errors.

# How the Problems Are Solved

Currently we just remove it from the sidenav and will add it once
they're released. We're looking into a proper solution for the API
references.

# Additional Changes

None

# Additional Context

None
2025-06-04 08:41:10 +02:00
Fabienne BühlerandGitHub b8ff83454e docs: product roadmap and zitadel versions (#9838)
# Which Problems Are Solved

The current public roadmap can be hard to understand for customers and
it doesn't show the timelines for the different versions. which results
in a lot of requests.
It only outlines what is already fixed on the timeline, but doesn't give
any possibilities to outline future topics / features, which not yet
have a timeline

# How the Problems Are Solved

A new roadmap page is added
- Outline for each version when it will have which state
- Outline different zitadel versions with its features, deprecations,
breaking changes, etc.
- Show future topics, which are not yet on the roadmap
2025-06-03 13:44:04 +00:00
IraqandGitHub ae1a2e93c1 feat(api): moving organization API resourced based (#9943) 2025-06-02 16:27:53 +00:00
7eb45c6cfd feat: project v2beta resource API (#9742)
# Which Problems Are Solved

Resource management of projects and sub-resources was before limited by
the context provided by the management API, which would mean you could
only manage resources belonging to a specific organization.

# How the Problems Are Solved

With the addition of a resource-based API, it is now possible to manage
projects and sub-resources on the basis of the resources themselves,
which means that as long as you have the permission for the resource,
you can create, read, update and delete it.

- CreateProject to create a project under an organization
- UpdateProject to update an existing project
- DeleteProject to delete an existing project
- DeactivateProject and ActivateProject to change the status of a
project
- GetProject to query for a specific project with an identifier
- ListProject to query for projects and granted projects
- CreateProjectGrant to create a project grant with project and granted
organization
- UpdateProjectGrant to update the roles of a project grant
- DeactivateProjectGrant and ActivateProjectGrant to change the status
of a project grant
- DeleteProjectGrant to delete an existing project grant
- ListProjectGrants to query for project grants
- AddProjectRole to add a role to an existing project
- UpdateProjectRole to change texts of an existing role
- RemoveProjectRole to remove an existing role
- ListProjectRoles to query for project roles

# Additional Changes

- Changes to ListProjects, which now contains granted projects as well
- Changes to messages as defined in the
[API_DESIGN](https://github.com/zitadel/zitadel/blob/main/API_DESIGN.md)
- Permission checks for project functionality on query and command side
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- ListProjects now also correctly lists `granted projects`
- Permission checks for project grant and project role functionality on
query and command side
- Change existing pre checks so that they also work resource specific
without resourceowner
- Added the resourceowner to the grant and role if no resourceowner is
provided
- Corrected import tests with project grants and roles
- Added testing to unit tests on command side
- Change update endpoints to no error returns if nothing changes in the
resource
- Changed all integration test utility to the new service
- Corrected some naming in the proto files to adhere to the API_DESIGN

# Additional Context

Closes #9177

---------

Co-authored-by: Livio Spring <[email protected]>
2025-05-21 14:40:47 +02:00
490e4bd623 feat: instance requests implementation for resource API (#9830)
<!--
Please inform yourself about the contribution guidelines on submitting a
PR here:
https://github.com/zitadel/zitadel/blob/main/CONTRIBUTING.md#submit-a-pull-request-pr.
Take note of how PR/commit titles should be written and replace the
template texts in the sections below. Don't remove any of the sections.
It is important that the commit history clearly shows what is changed
and why.
Important: By submitting a contribution you agree to the terms from our
Licensing Policy as described here:
https://github.com/zitadel/zitadel/blob/main/LICENSING.md#community-contributions.
-->

# Which Problems Are Solved

These changes introduce resource-based API endpoints for managing
instances and custom domains.

There are 4 types of changes:

- Endpoint implementation: consisting of the protobuf interface and the
implementation of the endpoint. E.g:
606439a17227b629c1d018842dc3f1c569e4627a
- (Integration) Tests: testing the implemented endpoint. E.g:
cdfe1f0372b30cb74e34f0f23c6ada776e4477e9
- Fixes: Bugs found during development that are being fixed. E.g:
acbbeedd3259b785948c1d702eb98f5810b3e60a
- Miscellaneous: code needed to put everything together or that doesn't
fit any of the above categories. E.g:
529df92abce1ffd69c0b3214bd835be404fd0de0 or
6802cb5468fbe24664ae6639fd3a40679222a2fd

# How the Problems Are Solved

_Ticked checkboxes indicate that the functionality is complete_

- [x] Instance
  - [x] Create endpoint
  - [x] Create endpoint tests
  - [x] Update endpoint
  - [x] Update endpoint tests
  - [x] Get endpoint
  - [x] Get endpoint tests
  - [x] Delete endpoint
  - [x] Delete endpoint tests
- [x] Custom Domains
  - [x] Add custom domain
  - [x] Add custom domain tests
  - [x] Remove custom domain
  - [x] Remove custom domain tests
  - [x] List custom domains
  - [x] List custom domains tests
- [x] Trusted Domains
  - [x] Add trusted domain
  - [x] Add trusted domain tests
  - [x] Remove trusted domain
  - [x] Remove trusted domain tests
  - [x] List trusted domains
  - [x] List trusted domains tests

# Additional Changes

When looking for instances (through the `ListInstances` endpoint)
matching a given query, if you ask for the results to be order by a
specific column, the query will fail due to a syntax error. This is
fixed in acbbeedd3259b785948c1d702eb98f5810b3e60a . Further explanation
can be found in the commit message

# Additional Context

- Relates to #9452 
- CreateInstance has been excluded:
https://github.com/zitadel/zitadel/issues/9930
- Permission checks / instance retrieval (middleware) needs to be
changed to allow context based permission checks
(https://github.com/zitadel/zitadel/issues/9929), required for
ListInstances

---------

Co-authored-by: Livio Spring <[email protected]>
2025-05-21 10:50:44 +02:00
+2 8fdd58f506 docs: add actions v2 docs (#9652)
# Which Problems Are Solved

There is no documentation yet for Actions v2 regarding the different
usable types and for migrating from Actions v1 to v2.

# How the Problems Are Solved

Add documentation for all use-cases.

# Additional Changes

None

# Additional Context

Closes #9456

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Silvan <[email protected]>
Co-authored-by: Ramon <[email protected]>
Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Kenta Yamaguchi <[email protected]>
Co-authored-by: Harsha Reddy <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Iraq <[email protected]>
Co-authored-by: Copilot <[email protected]>
2025-04-09 13:29:58 +02:00
+6 07ce3b6905 chore!: Introduce ZITADEL v3 (#9645)
This PR summarizes multiple changes specifically only available with
ZITADEL v3:

- feat: Web Keys management
(https://github.com/zitadel/zitadel/pull/9526)
- fix(cmd): ensure proper working of mirror
(https://github.com/zitadel/zitadel/pull/9509)
- feat(Authz): system user support for permission check v2
(https://github.com/zitadel/zitadel/pull/9640)
- chore(license): change from Apache to AGPL
(https://github.com/zitadel/zitadel/pull/9597)
- feat(console): list v2 sessions
(https://github.com/zitadel/zitadel/pull/9539)
- fix(console): add loginV2 feature flag
(https://github.com/zitadel/zitadel/pull/9682)
- fix(feature flags): allow reading "own" flags
(https://github.com/zitadel/zitadel/pull/9649)
- feat(console): add Actions V2 UI
(https://github.com/zitadel/zitadel/pull/9591)

BREAKING CHANGE
- feat(webkey): migrate to v2beta API
(https://github.com/zitadel/zitadel/pull/9445)
- chore!: remove CockroachDB Support
(https://github.com/zitadel/zitadel/pull/9444)
- feat(actions): migrate to v2beta API
(https://github.com/zitadel/zitadel/pull/9489)

---------

Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Stefan Benz <[email protected]>
Co-authored-by: Silvan <[email protected]>
Co-authored-by: Ramon <[email protected]>
Co-authored-by: Elio Bischof <[email protected]>
Co-authored-by: Kenta Yamaguchi <[email protected]>
Co-authored-by: Harsha Reddy <[email protected]>
Co-authored-by: Livio Spring <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
Co-authored-by: Iraq <[email protected]>
Co-authored-by: Florian Forster <[email protected]>
Co-authored-by: Tim Möhlmann <[email protected]>
Co-authored-by: Copilot <[email protected]>
Co-authored-by: Max Peintner <[email protected]>
2025-04-02 16:53:06 +02:00